/**
 * olam mcp revoke <user> <world> <service>
 *
 * When multi_tenant: false (OLAM_MCP_MULTI_TENANT unset/false): warns and exits 0.
 * When multi_tenant: true: calls DELETE /entitlement/:user/:world/:service on
 * mcp-auth. Server drops that user:world:service from its revocation cache; next
 * fetch-creds call for that service returns 403; world drops the token on next merge.
 */
import pc from 'picocolors';
import { printError } from '../../output.js';
export function registerMcpRevoke(cmd) {
    cmd
        .command('revoke <user> <world> <service>')
        .description('Revoke a user\'s MCP service entitlement (multi-tenant mode only)')
        .action(async (user, world, service) => {
        const multiTenant = (process.env['OLAM_MCP_MULTI_TENANT'] ?? '').toLowerCase() === 'true';
        if (!multiTenant) {
            console.warn(pc.yellow('⚠ revocation only meaningful in multi_tenant mode — no-op'));
            return;
        }
        const baseUrl = process.env['OLAM_MCP_AUTH_SERVICE_URL'] ?? 'http://127.0.0.1:9998';
        const secret = process.env['OLAM_MCP_AUTH_SECRET'] ?? '';
        const headers = { 'Content-Type': 'application/json' };
        if (secret)
            headers['X-Olam-Mcp-Secret'] = secret;
        let res;
        try {
            res = await fetch(`${baseUrl}/entitlement/${encodeURIComponent(user)}/${encodeURIComponent(world)}/${encodeURIComponent(service)}`, { method: 'DELETE', headers });
        }
        catch (err) {
            printError(`Could not reach mcp-auth service: ${err instanceof Error ? err.message : 'unknown'}`);
            process.exitCode = 1;
            return;
        }
        if (!res.ok) {
            let msg = `HTTP ${res.status}`;
            try {
                const body = await res.json();
                if (body.error)
                    msg = body.error;
            }
            catch { /* ignore */ }
            printError(`Revoke failed: ${msg}`);
            process.exitCode = 1;
            return;
        }
        console.log(pc.green(`✓ Revoked: ${user} / ${world} / ${service}`));
        console.log(pc.dim('  Next fetch-creds call returns 403; token cleared on next merge.'));
    });
}
//# sourceMappingURL=revoke.js.map